Economic substance for licensed vasps for Early-stage Founders

Why Economic Substance Determines Whether Your Licence Holds

A virtual asset service provider (VASP) licence is not simply a certificate filed with a regulator and left on a shelf. Every serious licensing regime – MiCA in the European Union, VARA in Dubai, the Payment Services Act in Singapore, the VASP licensing framework administered by the Securities and Futures Commission in Hong Kong – requires that the licensed entity conduct genuine business activity in the jurisdiction that authorised it. For early-stage founders, this is the requirement that most commonly causes a licence to stall, a renewal to fail, or a banking relationship to collapse.

Economic substance, in the digital-asset context, means that your licensed entity has real decision-makers present, real operational processes running, and a real footprint that a supervising regulator can examine. Regulators across the major hubs are increasingly moving from paper review to on-site assessment. The question is not whether substance will be tested. It is whether yours will pass.

This page sets out how early-stage founders can build and document economic substance correctly from the outset – mapping the regulatory basis, the common structural mistakes, and the cross-border interactions that most founders underestimate.

What Does Economic Substance Actually Require Under a VASP Regime?

Economic substance for a licensed VASP means that the entity has sufficient presence in the licensing jurisdiction to justify its authorisation – a threshold tested differently by each regulator but converging on a set of core indicators. Those indicators include: locally resident qualified management, physical premises, adequate staffing with appropriate skills, operational systems hosted or accessible within the jurisdiction, and decision-making that visibly takes place there. Regulators do not accept a nominal directorship, a forwarding address, or a management team that never appears in the jurisdiction.

Under MiCA, a CASP (crypto-asset service provider) authorisation granted by a national competent authority – such as the Bank of Lithuania or the Malta Financial Services Authority – requires that the applicant demonstrate genuine establishment in that member state. The passporting benefit that MiCA provides is conditioned on substance in the home-state entity. A shell authorisation in one member state that effectively operates from a second member state is the precise fact pattern ESMA's supervisory convergence work is designed to detect and unwind.

In Dubai, VARA's activity-based licence categories each carry their own operational expectations. VARA conducts periodic assessments of licensed entities and expects senior management to be reachable and locally present for meetings. Founders who obtain a VARA licence and then base their entire team abroad quickly discover that the licence renewal process becomes the enforcement moment.

The Singapore MAS Digital Payment Token regime similarly scrutinises the genuineness of local establishment before granting a standard or major payment institution licence. MAS has, in recent periods, declined applications where the proposed management structure lacked clear Singapore-based accountability. These are not edge cases. They are the ordinary application of a principle that has become standard across the flagship hubs.

The CTA below is addressed to founders who have not yet committed to a structure.

If you are deciding where to license and how to build the operating entity, the substance requirements will shape your cost model before anything else. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. To map the licence, banking and substance stack for your build, write to Map your options or contact info@oboluslaw.com.

Why Early-Stage Founders Face a Distinct Substance Problem

Founders at the early stage carry a structural disadvantage in substance compliance: they are typically building a lean team, managing costs, and operating from wherever their technical co-founders are based. That operational reality conflicts directly with what a licensing regulator expects to see on the ground.

The most common pattern we see is a founder who has incorporated an entity in a licensing jurisdiction, appointed a local director – sometimes a professional services firm providing a nominee directorship – and assumed that this satisfies the substance requirement. It does not. Nominee directors who lack genuine authority over the VASP's operations will not satisfy a regulator conducting a substance review. In fact, where a nominee director is identified as having no real involvement in decision-making, the regulator may treat this as a fitness-and-propriety concern for the beneficial owner, not merely an administrative deficiency.

A second common pattern is a founder who obtains a registration or licence in an offshore or lighter-touch jurisdiction and assumes it covers user-facing activity in the EU, the UK, or major Asian markets. That assumption is wrong. Operating a VASP service to users in a jurisdiction without holding the authorisation that jurisdiction requires – regardless of where the entity is incorporated – exposes the business to enforcement action in the user's jurisdiction. A BVI registration or a Cayman VASP licence does not authorise EU users to be onboarded under MiCA.

In our practice, we see the substance gap emerge most visibly at two moments: when the founder applies for a business bank account for the licensed entity and the bank's correspondent questionnaire asks for proof of local payroll and local management decisions, and when the regulator conducts a first annual review and asks for meeting minutes, local office lease agreements and salary records. Founders who planned substance as an afterthought discover at these moments that the licence is at risk.

How Do You Build Substance Correctly From Day One?

Building substance correctly means treating the licensing jurisdiction as a genuine operational base, not a registration address – and that planning has to begin before the application is filed. The steps below reflect the sequence that, in our experience, produces a substance structure that survives regulatory review and satisfies the banking due diligence that follows.

The first step is identifying which activities are regulated in the target jurisdiction and which of those will be performed by the licensed entity versus a group entity elsewhere. A clear functional allocation – where compliance, treasury, customer onboarding and technology decisions sit – is the foundation of a defensible substance argument. Regulators and banks both look for clarity on this question. Ambiguity is read as a red flag.

The second step is securing local management with genuine authority. In practice, this means at least one senior employee or executive director with a primary employment contract in the licensing jurisdiction, demonstrable expertise in the regulated activity, and authority to bind the entity on operational decisions. For founders who are not themselves relocating, this means hiring a qualified local compliance officer or chief operating officer early – not as a formality, but as a real leadership appointment.

The third step is establishing a physical, verifiable presence. A registered office at a service provider's address does not constitute premises for substance purposes. The licensed entity needs a dedicated office space, even if modest, with a lease that can be produced to the regulator. In some hubs – ADGM in Abu Dhabi, AIFC in Kazakhstan, and certain EU member states – minimum staffing and minimum office requirements are explicitly specified in the licensing conditions or the regulator's published expectations.

The fourth step is creating contemporaneous operational documentation. Regulators reviewing substance look for board and management meeting minutes that show decisions being made locally, compliance reports reviewed by local management, and AML/KYC determinations signed off within the jurisdiction. Documents backdated after a regulatory enquiry are not only ineffective – they create a secondary compliance problem.

A practical note on the Travel Rule (the obligation to pass originator and beneficiary data with a virtual asset transfer): compliance with the Travel Rule requires that the VASP has operational systems and qualified staff who can manage the data-sharing workflow. In substance reviews, VARA, MAS and the Bank of Lithuania all treat Travel Rule implementation as a proxy for the genuineness of local operations. If the licensed entity cannot demonstrate it controls its own Travel Rule compliance function, substance is undermined.

The Cross-Border Reality: Multiple Licences, Multiple Substance Obligations

A VASP operating across more than one jurisdiction does not discharge its substance obligation in each jurisdiction by pointing to a well-staffed head office elsewhere. Each licensed entity – regardless of common ownership – must satisfy the substance test in its own jurisdiction. This is the cross-border reality that founders most consistently underestimate.

Consider a typical early-stage structure: a holding company in the BVI or Cayman Islands, a CASP authorisation in Lithuania or Malta, a VARA licence in Dubai for the MENA market, and aspirations to onboard users in Singapore under the Payment Services Act. Each of those four entities or licence obligations carries its own substance logic. The Lithuanian or Maltese CASP entity needs to look like a real EU financial services business. The VARA entity in Dubai must be demonstrably operational in the mainland Dubai regulatory perimeter. The Singapore entity must satisfy MAS that management is locally accountable.

In our cross-border practice, we regularly advise founders who discover this multi-entity substance burden only after they have designed a structure optimised purely for tax efficiency or capital efficiency. Re-engineering a structure to meet substance requirements after the licences are applied for is significantly more expensive and time-consuming than building substance into the design from the start. It also creates a period of regulatory exposure during which the business may be operating under a licence that is technically at risk.

The interaction with banking is equally direct. Correspondent banks serving VASP accounts in the EU, UAE and Singapore routinely conduct enhanced due diligence that mirrors – and sometimes exceeds – the regulator's own substance expectations. A licensed VASP that cannot demonstrate local payroll, local management meetings and a local compliance function will face account closure or denial of access even if the regulator has not yet raised a concern.

Allied counsel in the relevant jurisdiction can be critical at this stage. We coordinate with local practitioners in licensing hubs to ensure that substance planning reflects the current supervisory posture of the regulator on the ground, not a generic reading of published guidelines that may be several update cycles behind practice.

Common Mistakes That Put Your Licence at Risk

Several substance errors appear persistently across early-stage VASP matters, regardless of jurisdiction. Identifying them in advance is the difference between a clean licence and a remediation process.

The most costly mistake is conflating the holding structure with the operating entity. The licensed VASP must itself have substance. The fact that the parent group has a well-staffed head office is not substance in the subsidiary that holds the licence. Regulators assess the entity, not the group.

A second persistent error is delegating all compliance functions to a third-party compliance-as-a-service provider based outside the licensing jurisdiction. These services have a legitimate role in supporting an internal function – but they cannot substitute for it. The regulator expects to see an accountable individual inside the licensed entity who owns the compliance programme and can speak to it under examination.

A third error, particularly in EU jurisdictions transitioning to MiCA, is assuming that a pre-MiCA registration automatically converts into a MiCA CASP authorisation without a fresh substance assessment. The transition from a lighter-touch VASP registration to a full CASP authorisation involves a substantive review of the entity's fitness, its operational systems and – critically – its substance. Founders who treated a pre-MiCA registration as a permanent asset will find that the MiCA authorisation process tests substance afresh.

Finally, many founders underestimate the substance implications of service agreements between group entities. Where the licensed VASP outsources core functions – technology, risk management, customer support – to an affiliate, the regulator will scrutinise whether the licensed entity retains meaningful oversight and accountability. Under MiCA, VARA and the MAS framework, outsourcing arrangements that effectively hollow out the licensed entity are a ground for supervisory concern or licence condition imposition.

Decision Matrix: Which Substance Structure Fits Your Profile?

No single substance model suits every early-stage founder. The right structure depends on where the founding team is based, where the primary user market sits, what the business can realistically staff and fund in a licensing jurisdiction, and how quickly a licence is needed to close a funding round or launch a product.

Profile A – Solo founder or two-person founding team, EU target market, seed stage. The most defensible path for this profile is typically a CASP authorisation in a single EU member state – the Bank of Lithuania and the MFSA in Malta are both credible options – with a local compliance manager hired before the application is submitted. The compliance manager becomes the primary substance anchor. The founding team does not need to relocate, but must be able to demonstrate regular presence and documented decision-making in the licensing jurisdiction. Timeline from a well-prepared application varies by jurisdiction; the Bank of Lithuania has historically processed applications faster than many EU peers, though timelines are extending under MiCA. This profile's key risk is understaffing the local function in the first twelve months.

Profile B – Small founding team with MENA market focus, Series A imminent. A VARA licence in Dubai is a credible primary licence for MENA operations, with the added benefit of DIFC-adjacent legal infrastructure for dispute resolution. VARA expects locally based senior management and a physical office. For this profile, the substance commitment is higher than the EU route – but the regulatory process is generally faster and the banking environment in Dubai is more receptive to VASP accounts than many EU banking markets at the early stage. The key risk for this profile is attempting to serve EU users from the VARA entity without a concurrent MiCA authorisation.

Profile C – Technical founding team with global ambitions, well-funded at seed. For this profile, a two-entity structure is typically necessary from the outset: a CASP authorisation in the EU and a separate licence in a second hub (VARA, MAS or SFC depending on the target market). Each entity needs independently credible substance. The investment is higher, but the alternative – operating globally from a single offshore or single-hub licence – is the AUDIENCE_MYTH addressed below. This profile's key risk is designing the inter-entity service agreements without adequate regulatory input, creating the outsourcing hollowing-out problem described above.

In all three profiles, the substance architecture must be designed before the application is submitted. Retrofitting substance after a licence is granted is possible, but it is expensive, time-consuming, and requires disclosure to the regulator of the change – which itself invites scrutiny of why the original substance was inadequate.

A Common Assumption About Offshore Licences – And Why It Creates Risk

A common assumption among early-stage founders is that a single offshore licence – in the BVI, Cayman Islands or a similarly light-touch registry – is sufficient to operate a VASP business serving users globally. This assumption is wrong in almost every commercially relevant scenario, and it is the single most frequent source of the enforcement exposure, banking failures and lost fundraising rounds that we see in early-stage VASP matters.

An offshore registration or licence authorises the entity to operate within the regulatory perimeter of the issuing jurisdiction. It does not authorise the service to be provided to users in the EU, the UK, the UAE, Singapore, Hong Kong or the United States. Each of those jurisdictions applies its own regulatory trigger – typically based on where the user is located, not where the entity is incorporated. A BVI-incorporated VASP serving German users without a MiCA CASP authorisation is operating illegally under EU law, regardless of what the BVI FSC registration says.

We have seen this play out at Series A stage, when institutional investors conducting legal due diligence identify unlicensed user bases in major jurisdictions and price the enforcement risk into their term sheet – or walk. We have also seen it at the banking stage, when a correspondent bank identifies the mismatch between the entity's licence and its actual user geography and closes the account.

The correct use of an offshore entity in a VASP structure is as a holding company or treasury vehicle – a function for which the BVI and Cayman Islands are well-suited and well-understood by institutional investors – not as the operating entity that faces regulated users. The licensed operating entities in the regulated hubs then sit below the offshore holdco. Each licensed entity carries its own substance obligation. The holdco carries none – but it also conducts no regulated activity.

In a recent licensing matter, an early-stage exchange had onboarded users across three EU member states using a Cayman VASP registration as its regulatory basis. We were instructed after a banking review identified the structure. Working with allied counsel in the relevant EU jurisdictions, we mapped the unlicensed exposure, structured a disclosure and remediation plan, and initiated MiCA CASP applications in the appropriate home-member-state jurisdiction. The process required several months and imposed a period of restricted user-onboarding. The outcome was a clean licence path – but the cost in time and management attention was substantially higher than a correctly structured application at the outset would have been.

If a prior application stalled, a bank account was closed, or a due diligence process surfaced a licensing gap, a second read of the structure can identify the cause and the path forward. If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back. Write to info@oboluslaw.com or message us via Map your options.

Related at OBOLUS

Related at OBOLUS

• Licensing & Registration for Digital-Asset Businesses – our full practice overview covering VASP licensing across 70+ jurisdictions
• Crypto Exchange Setup in Malta – jurisdiction-specific guide to MFSA authorisation and substance for EU-licensed exchanges
• Economic Substance for Licensed VASPs – Established Operators – the same substance analysis applied to businesses scaling from a first licence to a multi-hub structure

FAQ

How long does a crypto licence take to obtain?

Timelines vary materially by jurisdiction and by the completeness of the application. In our experience, well-prepared applications in faster EU member states under the MiCA transition process can move within a matter of weeks for the initial review, but full CASP authorisation typically takes several months. VARA in Dubai and MAS in Singapore operate on timelines that depend significantly on the complexity of the proposed activity and the quality of the submitted business plan and compliance documentation. No timeline can be guaranteed; the regulator's queue and the substance of the application are both variables.

Which jurisdiction is best for licensing my crypto business?

There is no single best jurisdiction. The right licensing hub depends on where your users are, what activities you are conducting, what your founding team can credibly staff, and what your banking needs are. A CASP authorisation in an EU member state provides passporting across the EU/EEA – critical if EU users are a target market. VARA in Dubai suits MENA-focused operations. MAS in Singapore is the benchmark for Asia-Pacific. Most commercially serious VASP businesses ultimately need more than one licence. We map the options against your specific business model before you commit.

Do I need a separate custody licence?

In most flagship licensing regimes, custody of client virtual assets is a separately regulated activity. Under MiCA, providing crypto-asset custody and administration is a distinct CASP service that must be authorised. VARA in Dubai similarly treats custody as a separate activity-based licence category. MAS under the Payment Services Act addresses safeguarding obligations for digital payment token service providers. Whether custody falls within your primary licence or requires a separate authorisation depends on the specific jurisdiction and the scope of your proposed activity – and it must be determined before the licence application is structured.

About OBOLUS

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – so that the substance obligation in each licensed entity is designed in from the start, not retrofitted after a banking failure or a regulatory enquiry surfaces the gap. To discuss your situation, contact info@oboluslaw.com.

By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VASP licence strategy and economic substance structures for early-stage digital-asset businesses across EU, UAE and Asia-Pacific hubs.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.